Struct Runtime 

pub struct Runtime { /* private fields */ }

Implementations

impl Runtime

pub async fn reexecute_live( &self, plan: &PreparedPlan, req: LiveRequest, authorizer: &dyn LiveAuthorizer, cancel: &CancelSignal, ) -> Result<LiveResult, LiveRefusal>

Re-execute a decision shape live (spec 026): a new decision, under fresh bounds, with the host authorizing every external attempt immediately before it is sent. The only entry point that accepts an authorizer; decide, capture, replay and comparison never dispatch on its behalf.

Refused before admission, with nothing presented or spent: a reused historical decision id, a snapshot whose computed identity is not the stated one, an invalid capture configuration, a plan whose proposals exceed the document bound, and every admission refusal of decide.

let cancel = rustev_core::seams::CancelSignal::new();
let _ = rt.reexecute_live(plan, live, a, &cancel).await;
let _ = rt.decide(plan, req, &cancel).await;

// `decide` takes no authorizer: only `reexecute_live` does.
rt.decide(plan, req, &rustev_core::seams::CancelSignal::new(), a).await;

// Nor does capture.
rt.decide_with_capture(plan, req, &rustev_core::seams::CancelSignal::new(), c, a).await;

pub async fn reexecute_live_with_gate( &self, plan: &PreparedPlan, req: LiveRequest, authorizer: &dyn LiveAuthorizer, cancel: &CancelSignal, spend: LiveSpend<'_>, ) -> Result<LiveResult, LiveRefusal>

Live re-execution with a durable spend gate, after budget and host authorization on every attempt. Existing ungated callers are unchanged. Plans with acquisitions are refused before admission. Use reexecute_live_with_sources to supply source postures.

pub async fn reexecute_live_with_sources( &self, plan: &PreparedPlan, req: LiveRequest, authorizer: &dyn LiveAuthorizer, cancel: &CancelSignal, spend: LiveSpend<'_>, sources: LiveSources<'_>, ) -> Result<(LiveResult, SourceOutcome), LiveRefusal>

Gated live execution with explicit source postures and separate observations.

impl Runtime

pub fn builder( clock: Arc<dyn Clock>, sink: Arc<dyn EvidenceSink>, config: RuntimeConfig, ) -> RuntimeBuilder

pub fn gauges(&self) -> Gauges

pub fn backend_terms( &self, backend_id: &str, ) -> Option<(&BackendDescriptor, CostModel)>

The registered backend’s descriptor and static cost model, for a host’s checks before any dispatch (spec 043, 3.7.1).

pub fn prepare(&self, compiled: Compiled) -> Result<PreparedPlan, PrepareError>

Check a compiled plan against the registered backends (spec 003, 3.5.3 and 3.6.5).

pub fn invalidate_plan(&self, plan: &PreparedPlan) -> Option<InvalidationResult>

Invalidate every reusable result in this plan’s namespace, for any correction, revocation, erasure, artifact withdrawal or policy change the host observed. The generation advances before entries are removed, so a result captured earlier is never stored or served. A plan with a persistent tier also has its namespace marked unavailable in this process until Runtime::invalidate completes for it (spec 044, 3.10.3).

pub fn invalidate_scope( &self, plan: &PreparedPlan, principal_handle: &[u8], ) -> Option<InvalidationResult>

Invalidate reusable results for one opaque authorized scope, as for an erasure or a scope revocation, as Runtime::invalidate_plan does for a namespace.

pub async fn invalidate( &self, plan: &PreparedPlan, principal_handle: Option<&[u8]>, ) -> Option<InvalidationResult>

Invalidate the plan’s namespace, or one authorized scope of it, in every tier (spec 044, 3.10.3): the memory tier at once, then the store, whose generation advances. The selection is unavailable to the persistent tier until the store answers; a failure leaves it unavailable, and a later call reconciles it. Invalidation is not carried to other processes (3.10.4).

pub async fn decide( &self, plan: &PreparedPlan, req: DecisionRequest, cancel: &CancelSignal, ) -> Result<Decided, DecideError>

Run one decision (spec 003). cancel is the caller’s cancellation.

pub async fn decide_keyed( &self, plan: &PreparedPlan, req: DecisionRequest, dimensions: &BTreeMap<String, Handle>, cancel: &CancelSignal, ) -> Result<Decided, DecideError>

Runtime::decide with the host’s key dimensions (spec 044, 3.5 item 3): one scope handle per dimension the plan’s decision_cache declares. A decision missing a declared dimension, or naming one the plan does not declare, is neither served from nor admitted to the decision cache, and runs or is refused under the policy’s admission. A plan without the decision cache ignores them.

pub async fn decide_observed( &self, plan: &PreparedPlan, req: DecisionRequest, cancel: &CancelSignal, observer: &dyn ProgressObserver, ) -> Result<Decided, DecideError>

Run with a value-free observer. The ordinary entry point has no callbacks.

pub fn observer_panics(&self) -> u64

Contained progress callback panics across this runtime’s decisions.

pub async fn decide_with_capture( &self, plan: &PreparedPlan, req: DecisionRequest, cancel: &CancelSignal, capture: &CaptureConfig, ) -> Result<CapturedDecision, CaptureConfigError>

Runtime::decide with opt-in bounded capture of every supplied value (spec 004, 5.3). An invalid configuration is refused before admission. Dropping the future returns nothing, as for decide.

pub fn decide_streaming<'a>( &'a self, plan: &'a PreparedPlan, req: DecisionRequest, cancel: &'a CancelSignal, stream_buffer: usize, ) -> Result<(impl Future<Output = Result<Decided, DecideError>> + Send + 'a, GenerationStream), GenerationError>

Start an opt-in field stream. Poll the returned future to drive execution; the receiver may be polled independently and never backpressures it.

pub fn reconcile(&self, attempt_id: &str, observed_units: u64) -> bool

A later observed charge for an attempt whose cost was unknown, applied to the shared ledger (spec 003, 3.5.5). Delivered records are never rewritten.